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REMARKS 

In response to the Final Office Action mailed November 24, 2008 ("Office 
Action") 1 , the response for which is due March 24, 2009 with a one-month extension of 
time, Applicant respectfully requests reconsideration and reexamination of this 
application and the timely allowance of the pending claims. 

I. Interview Summary 

Applicant acknowledges, with appreciation, the telephonic interview conducted 
on February 26, 2009, between the undersigned and Examiner Kim. Also present on 
the call were Kristie Decelles of assignee NetScout Systems, and Maura K. Moran 
(Reg. No. 31,859) and Reza Sadr (Reg. No. 63,292) of Finnegan. The substance of the 
interview is made of record in the remarks below. 

II. Status and Disposition of the Claims 

In the instant application, claims 1-15, 21-29, 32-34 and 40-47, of which claims 1, 
21, 40 and 42 are independent, were previously pending and under consideration on 
the merits. 

In the Office Action, the following actions were taken: 

1) Claims 1-7, 12-15, 21-28, 34 and 40-47 were rejected under 35 
U.S.C. § 103(a) as being unpatentable over US Patent Application 
Pub. No. 2002/0083344 by Vairavan (hereinafter Vairavan) in view 
of US Patent No. 5,796,942 to Esbensen (hereinafter Esbensen), 
and US Patent No. 6,772,349 to Martin et. al. (hereinafter Martin). 



1 The Office Action contains a number of statements reflecting characterizations of the related 
art and the claims. Regardless of whether any such statement is identified herein, Applicant 
declines to automatically subscribe to any statement or characterization in the Office Action. 
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2) Claims 8-1 1 , 29, 32 and 33 were rejected under 35 U.S.C. § 1 03(a) 
as being unpatentable over Vairavan in view of Esbensen and 
Martin, and further in view of US Patent No. 7,159,237 to Schneier 
et al. (hereinafter Schneier). 



III. Amendments to the Claims 

In this response to the Office Action, Applicant amends claims 1-3, 8-13, 15, 21- 
24, 28, 29, 32-34, and 40-44, and adds new claims 48-53. Many of the amendments 
add missing antecedent bases or improve readability. Upon entry of the amendments, 
claims 1-15, 21-29, 32-34, and 40-53 will be pending in this application. 

Support for the amendments may be found, among other places, in the following 
parts of the Specification: 

• FIG. 1 depicts LAN/WAN link 15 linking a first network (WAN 10) to 
the combination of Gateway 20 and one or more LAN segments 30. 
Also, probe 40 is installed on the LAN/WAN link 15, outside the 
combination of Gateway 20 and one or more LAN segments 30, 
and IDS 50 is also outside the combination of Gateway 20 and one 
or more LAN segments 30. Further, IDS 50 is linked to probe 40 
via the second network link 45. 

• "Intrusion attacks typically originate from outside an organization's 
network , in that they are directed into an organization's network via 
its "connection" to the outside world-which is typically the WAN 
interface. However, since existing IDSs are typically located on a 
LAN, the IDS typically sees a mixture of internal traffic , which is 
generally safe, and external traffic, which potentially contains 
intrusion attacks" (paragraph [0005], emphases added). 

• "In one implementation, IDS functionality is added to an existing 
network probe. The probe converts WAN traffic into an Ethernet 
format traffic that an existing IDS can monitor . Including the IDS- 
support functionality within the probe enables an IDS to see only 
WAN traffic . Hence, false positives arising from wrongly 
interpreting (benign) LAN traffic are eliminated . Furthermore, 
WANs are generally slower than LANs; so the IDS is now exposed 
to a reduced amount of traffic . False negatives resulting from 
performance shortcomings of an IDS are therefore minimized" 
(paragraph [0011], emphases added). 
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• "The filter module 70 can include pre-defined filters 140 and, 
optionally, a set of user-defined filters 150. The filters can utilize 
predefined sets of criteria to determine whether a packet should be 
forwarded. For example, the pre-defined filters 140 can be 
configured to filter traffic that is not useful to the IDS 50 in 
diagnosing an intrusion attack. For example, management network 
traffic may be filtered out by the pre-defined filters 140. ... The 
filtered traffic can be stored in the audit trail buffer 90, as described 
above" (paragraph [0045]). 

Applicant thus respectfully requests reconsideration. 

III. Response to Rejections 

A. The Rejection of Claims 1-15. 21-29, 32-34 and 40-47 under 35 U.S.C. 
S103 Should be Withdrawn. 

In the Office Action, claims 1-15, 21-29, 32-34 and 40-47, 1-7, 12-15, 21-28, 34 

and 40-47 were rejected under 35 U.S.C. § 103(a) as being unpatentable over Vairavan 

in view of Esbensen and Martin alone or in combination with Schneier(see Office Action 

at pages 2, 3, and 8). Applicant respectfully traverses the above-cited rejections of the 

claims under 35 U.S.C. §1 03(a), because, for each of the claims, a prima facie case of 

obviousness has not been established. 



As addressed in the interview, the Examiner contends that the recited features of 
a probe located outside the second network, and an IDS located outside the second 
network and configured to not receive data packets exchanged inside the second 
network are addressed in the cited references. Applicant respectfully submits that 
neither Vairavan nor Esbensen nor Martin nor Schneier teaches or suggests those 
features that are recited in claim 1 . No agreement was reached during the interview, 
but the Examiner agreed to consider amendments to resolve the 35 U.S.C. § 103(a) 
rejections. Applicant herein makes amendments to place claims in allowable condition, 
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and respectfully requests such consideration of amended claim 1 , because neither 
Vairavan nor Esbensen nor Martin nor Schneier discloses at least the following features 
in amended claim 1: 

• "a probe located outside the second network," 

• "an intrusion detection system (IDS) for detecting the intrusion 
initiated in the first network toward the second network," and 

• "the IDS located outside the second network and configured to 
not receive data packets exchanged inside the second network." 

See amended Claim 1 . Applicant respectfully traverses the above-cited rejections of 
the claims under 35 U.S.C. § 103(a), because, for each of the claims, a prima facie 
case of obviousness has not been established. 

"The key to supporting any rejection under 35 U.S.C. 103 is the clear articulation 

of the reason(s) why the claimed invention would have been obvious [Rejections 

on obviousness cannot be sustained with mere conclusory statements." M.P.E.P. 
§ 2142, 8th Ed., Rev. 6 (Sept. 2007) (internal citation and inner quotation omitted). "The 
mere fact that references can be combined or modified does not render the resultant 
combination obvious unless the results would have been predictable to one of ordinary 
skill in the art." M.P.E.P. § 2143.01(111) (emphasis in original). "In determining the 
differences between the prior art and the claims, the question under 35 U.S.C. 103 is 
not whether the differences themselves would have been obvious, but whether the 
claimed invention as a whole would have been obvious. M.P.E.P. § 2141 .02(1) 
(emphases in original). 

"[T]he framework for objective analysis for determining obviousness under 
35 U.S.C. 103 is stated in Graham v. John Deere Co., 383 U.S. 1, 148 U.S.P.Q 459 
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(1966) The factual inquiries . . . [include determining the scope and content of the 

prior art and] . . . [ascertaining the differences between the claimed invention and the 
prior art." M.P.E.P. § 2141(11). "Office personnel must explain why the difference(s) 
between the prior art and the claimed invention would have been obvious to one of 
ordinary skill in the art." M.P.E.P. § 2141(111). 

The Supreme Court in KSR Int'l Co. v. Teleflex Inc., 82 U.S.P.Q.2d 1385 (U.S. 
2007) held that "[t]here is no necessary inconsistency between the idea underlying the 
TSM [teaching, suggestion, motivation] test and the Graham analysis." M.P.E.P. §2141 
(rev. 6, Sept. 2007), citing KSR at 82 U.S.P.Q. 2d at 1396. Applicant understands this 
to mean that when applicable, as here, TSM reasoning may still be applied not only by 
an examiner but also by Applicant to refute a §103 rejection. 

Here, a prima facie case of obviousness has not been established. The scope 
and content of the prior art has not been properly determined, nor have the differences 
between the claimed invention and the prior art been properly ascertained. Accordingly, 
a reason why the prior art would have rendered the claimed invention obvious to one of 
ordinary skill in the art has not clearly articulated. 

In this application, the cited references do not teach or suggest the above-cited 
recitations of independent amended claim 1 . For at least these reasons, claim 1 is 
allowable under 35 U.S.C. §1 03(a). For at least the reasons stated above with respect 
to claim 1 , claims 2-15, 44, and 45 are allowable at least since they depend, directly or 
indirectly, from claim 1 . 
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Independent claims 21, 40 and 42, although different in scope from claim 1, 
recite elements similar to claim 1 , and therefore, for at least the reasons stated above 
with respect to claim 1 , are also allowable. Further, for at least the reasons stated 
above with respect to claim 1, claims 22-29, 32-34, 41, 43, 46, and 47 are allowable at 
least since they depend, directly or indirectly, from one of claims 21 , 40, and 42. 

Accordingly, Applicant's claims 1-15, 21-29, 32-34 and 40-47 are patentably 
distinct from Vairavan, Esbensen, Martin and Schneier, alone or in combination. 
Applicant respectfully requests the rejection under 35 U.S.C. § 103(a) of claims 1-15, 
21-29, 32-34, and 40-47 to be withdrawn. 

IV. New Claims 

Each of the newly added claims 48-53, depends, either directly or indirectly, from 
one of the independent claims 1 and 21, and thus includes limitations similar to those 
discussed above, which are not taught or suggested by Vairavan, Esbensen, Martin, or 
Schneier, alone or in combination. Therefore, Applicant contends that, at least for the 
same reasons, new claims 48-53 are patentable. 

V. Conclusion 

In view of the foregoing response and remarks, Applicant respectfully requests 
the reconsideration of the rejections, the reexamination of this application, and the 
timely allowance of the pending claims. Please grant any extensions of time required to 



19 



PATENT 

Attorney Docket No. 09851.0006 



enter this response and charge any additional required fees to our deposit account 
06-0916. 

Respectfully submitted, 

FINNEGAN, HENDERSON, FARADOW, 
GARRETT & DUNNER, LLP., 



Dated: March 24, 2009 tor. S/** 4 **^ ^TjV/^ 

^ Maura K. Moran 
Reg. No. 31,859 
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